From 730c57a4d5c3e32d4f362ea895a78a1f583c7d9d Mon Sep 17 00:00:00 2001 From: Daniel Elskamp Date: Fri, 12 Jun 2026 05:16:51 +0200 Subject: [PATCH 1/2] chore: harden repo for public release - Add SECURITY.md with private vulnerability reporting policy - Add Dependabot config for npm and github-actions (grouped minor/patch) - Pin all GitHub Actions to commit SHAs (supply-chain hardening) - Add least-privilege `permissions: contents: read` to CI - Set package.json description and `engines.node` (>=22) - Align CI/release Node version to 22 to match README and engines --- .github/dependabot.yml | 18 ++++++++++++++++ .github/workflows/ci.yml | 9 +++++--- .github/workflows/release.yml | 16 +++++++------- SECURITY.md | 40 +++++++++++++++++++++++++++++++++++ package.json | 5 ++++- 5 files changed, 76 insertions(+), 12 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 SECURITY.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..7892b3a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,18 @@ +version: 2 +updates: + - package-ecosystem: npm + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 10 + groups: + # Batch routine dev/prod bumps into one PR to cut noise. + minor-and-patch: + update-types: + - minor + - patch + + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ab70ec8..aeed3a9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,17 +6,20 @@ on: - main - develop +permissions: + contents: read + jobs: check: name: Lint & Test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: - node-version: 20 + node-version: 22 cache: npm - name: Install dependencies diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e0ee0a9..6302f65 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,14 +18,14 @@ jobs: name: Generate changelog runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: # Full history + tags are required for conventional-changelog. fetch-depth: 0 # Check out the branch (not the detached tag) so we can commit CHANGELOG.md back. ref: develop - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 22 cache: npm @@ -57,7 +57,7 @@ jobs: run: cp RELEASE_NOTES.md release_body.md - name: Create / update GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3 with: tag_name: ${{ github.event.inputs.tag || github.ref_name }} body_path: release_body.md @@ -85,11 +85,11 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: - node-version: 20 + node-version: 22 cache: npm - name: Install Linux build dependencies @@ -103,7 +103,7 @@ jobs: - name: Import signing certificate (macOS) if: matrix.os == 'macos-latest' - uses: apple-actions/import-codesign-certs@v7 + uses: apple-actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7 with: p12-file-base64: ${{ secrets.MACOS_CERTIFICATE }} p12-password: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} @@ -132,7 +132,7 @@ jobs: run: rm -f "$RUNNER_TEMP/apple_api_key.p8" - name: Upload to GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3 with: tag_name: ${{ github.event.inputs.tag || github.ref_name }} fail_on_unmatched_files: true diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..88dd02e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,40 @@ +# Security Policy + +## Supported versions + +s3Manager is distributed as a desktop application. Only the latest released +version receives security fixes. Please make sure you are on the most recent +release before reporting an issue. + +## Reporting a vulnerability + +**Please do not report security vulnerabilities through public GitHub issues.** + +Instead, use GitHub's private vulnerability reporting: + +1. Go to the [**Security** tab](https://github.com/NoiXdev/s3Manager/security/advisories) of this repository. +2. Click **Report a vulnerability** and fill in the details. + +If you are unable to use private reporting, you may email the maintainer at +**ich@dginx.de** instead. + +Please include, where possible: + +- A description of the vulnerability and its impact. +- Steps to reproduce or a proof of concept. +- The affected version and your operating system. + +## What to expect + +- We aim to acknowledge new reports within **5 business days**. +- We will keep you informed as we investigate and work on a fix. +- Once a fix is released, we are happy to credit you in the release notes + unless you prefer to remain anonymous. + +## Scope + +s3Manager stores S3 access keys in the operating-system keychain (via Electron +`safeStorage`) and all other data in a local SQLite database; it does not +transmit data to any first-party server. Reports concerning credential +handling, IPC boundaries between the main and renderer processes, presigned-URL +generation, or the auto-update/release pipeline are especially welcome. diff --git a/package.json b/package.json index a5e2e69..7d6f5cc 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "name": "s3manager", "productName": "s3manager", "version": "1.0.0", - "description": "My Electron application description", + "description": "A cross-platform desktop app for managing S3-compatible object storage.", "main": ".vite/build/main.js", "private": true, "repository": { @@ -32,6 +32,9 @@ "email": "ich@dginx.de" }, "license": "MIT", + "engines": { + "node": ">=22" + }, "devDependencies": { "@electron-forge/cli": "^7.11.2", "@electron-forge/maker-deb": "^7.11.2", From 5b2151d2c26e4e13d288700bbc0da450133ab2c6 Mon Sep 17 00:00:00 2001 From: Daniel Elskamp Date: Fri, 12 Jun 2026 05:21:36 +0200 Subject: [PATCH 2/2] fix(lint): resolve pre-existing ESLint errors blocking CI CI only ran on PRs, so these 100 errors had accumulated unnoticed on develop. - Disable no-empty-function in test files (idiomatic no-op mock callbacks) - Disable import/no-unresolved in *.config.* (resolver can't read vitest's package exports map; the import is valid at build time) - Add inline disable for the ToastProvider default-context no-op 0 errors after this change (150 style warnings remain, non-blocking). --- .eslintrc.json | 16 +++++++++++++++- src/renderer/components/ui/ToastProvider.tsx | 1 + 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/.eslintrc.json b/.eslintrc.json index 2d7aa60..afda8e7 100644 --- a/.eslintrc.json +++ b/.eslintrc.json @@ -12,5 +12,19 @@ "plugin:import/electron", "plugin:import/typescript" ], - "parser": "@typescript-eslint/parser" + "parser": "@typescript-eslint/parser", + "overrides": [ + { + "files": ["**/*.test.ts", "**/*.test.tsx", "vitest.setup.ts"], + "rules": { + "@typescript-eslint/no-empty-function": "off" + } + }, + { + "files": ["*.config.ts", "*.config.mts", "*.config.cts"], + "rules": { + "import/no-unresolved": "off" + } + } + ] } diff --git a/src/renderer/components/ui/ToastProvider.tsx b/src/renderer/components/ui/ToastProvider.tsx index 46eafc6..9871c93 100644 --- a/src/renderer/components/ui/ToastProvider.tsx +++ b/src/renderer/components/ui/ToastProvider.tsx @@ -10,6 +10,7 @@ interface ToastApi { show: (message: string, kind?: ToastKind) => void; } +// eslint-disable-next-line @typescript-eslint/no-empty-function -- no-op default; a real provider always overrides this const ToastContext = createContext({ show: () => {} }); export function useToast(): ToastApi {